---
title: Promote to Major Security Incident
description: Promote a security incident to major security incident.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/promote-to-major-security-incident.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Working with MSI Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Promote to Major Security Incident

Promote a security incident to major security incident.

## Before you begin

Role required: sn\_si.analyst.

## Procedure

1.  Navigate to **Workspaces** > **Security Incident Response Workspace**.

2.  Open any security incident.

3.  Click **Promote to Major Security Incident**.

4.  On the form, fill in the fields such as Detection date, Estimated resolution date, Justification, and Potential impact.

    \[Omitted image "promote-msi.png"\] Alt text: Promote incident

5.  Click **Promote**.

    The incident record is promoted as a major security incident.

    After the incident record is promoted as a major security incident, **Major Security Incident** tag is applied and displayed on the form banner.

    **Note:** You can also unlink the major security incident if the incident is not critical, the incident will then be unlinked and lists under the list view for the security analyst remediation.


**Parent Topic:**[Working with MSI Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/working-with-msi-records.md)